Shared IPC namespace for containers in a pod #3817

mrunalp · 2015-01-27T00:34:27Z

This PR makes the containers in a pod share ipc namespace in addition to network namespace. The "network container" is renamed to "pod infra container" as per @thockin suggestion.
Here is some output from testing:

[root@kubernetes-minion-1 ~]# docker ps
CONTAINER ID        IMAGE                                  COMMAND                CREATED              STATUS              PORTS                    NAMES
5db6f3cea91c        dockerfile/nginx:latest                "nginx"                About a minute ago   Up About a minute                            k8s_mynginx.6617bbd0_1a59f6e9-a5b9-11e4-a611-0800279696e1.default.api_1a59f6e9-a5b9-11e4-a611-0800279696e1_b7f0a81d               
d99d954d65bc        google/cadvisor:0.8.0                  "/usr/bin/cadvisor"    7 minutes ago        Up 7 minutes                                 k8s_cadvisor.4c14154f_cadvisor-agent.file-6bb810db-kubernetes-minion-1.file_3fd0c171b08ee83650fd343a6fdf9653_aa7ac19c             
05187563d087        kubernetes/fluentd-elasticsearch:1.0   "/bin/sh -c '/usr/sb   9 minutes ago        Up 9 minutes                                 k8s_fluentd-es.f0e4cc_fluentd-to-elasticsearch.file-8cd71177-kubernetes-minion-1.file_a6e8b87c41aade4c1d35ead1804d8fc4_39c7aec3   
c81cc8a37ce4        kubernetes/pause:go                    "/pause"               14 minutes ago       Up 14 minutes       0.0.0.0:9191->80/tcp     k8s_POD.a29db6ef_1a59f6e9-a5b9-11e4-a611-0800279696e1.default.api_1a59f6e9-a5b9-11e4-a611-0800279696e1_b963898c                   
39b274cc5f5c        kubernetes/pause:go                    "/pause"               19 minutes ago       Up 19 minutes                                k8s_POD.a812958f_fluentd-to-elasticsearch.file-8cd71177-kubernetes-minion-1.file_a6e8b87c41aade4c1d35ead1804d8fc4_385ae96c        
5d9bc25d14ad        kubernetes/pause:go                    "/pause"               19 minutes ago       Up 19 minutes       0.0.0.0:4194->8080/tcp   k8s_POD.117b915_cadvisor-agent.file-6bb810db-kubernetes-minion-1.file_3fd0c171b08ee83650fd343a6fdf9653_88393ead                   
[root@kubernetes-minion-1 ~]# docker inspect 5db6f3cea91c | grep Mode
        "IpcMode": "container:c81cc8a37ce411133f366abe4d45e6ea91e6071485e4f29ed12b74419a5fa86b",
        "NetworkMode": "container:c81cc8a37ce411133f366abe4d45e6ea91e6071485e4f29ed12b74419a5fa86b",
[root@kubernetes-minion-1 ~]# docker inspect c81cc8a37ce4 | grep Pid
        "Pid": 13521,
[root@kubernetes-minion-1 ~]# docker inspect 5db6f3cea91c | grep Pid
        "Pid": 18463,
[root@kubernetes-minion-1 ~]# ls -l /proc/13521/ns
total 0
lrwxrwxrwx 1 root root 0 Jan 27 00:25 ipc -> ipc:[4026532395]
lrwxrwxrwx 1 root root 0 Jan 27 00:27 mnt -> mnt:[4026532393]
lrwxrwxrwx 1 root root 0 Jan 27 00:25 net -> net:[4026532398]
lrwxrwxrwx 1 root root 0 Jan 27 00:27 pid -> pid:[4026532396]
lrwxrwxrwx 1 root root 0 Jan 27 00:27 uts -> uts:[4026532394]
[root@kubernetes-minion-1 ~]# ls -l /proc/18463/ns
total 0
lrwxrwxrwx 1 root root 0 Jan 27 00:27 ipc -> ipc:[4026532395]
lrwxrwxrwx 1 root root 0 Jan 27 00:27 mnt -> mnt:[4026532510]
lrwxrwxrwx 1 root root 0 Jan 27 00:27 net -> net:[4026532398]
lrwxrwxrwx 1 root root 0 Jan 27 00:27 pid -> pid:[4026532513]
lrwxrwxrwx 1 root root 0 Jan 27 00:27 uts -> uts:[4026532511]

@thockin @vishh PTAL

vmarmol · 2015-01-27T00:37:19Z

pkg/kubelet/dockertools/docker.go

@@ -401,7 +401,7 @@ func inspectContainer(client DockerInterface, dockerID, containerName, tPath str
 		containerStatus.State.Running = &api.ContainerStateRunning{
 			StartedAt: util.NewTime(inspectResult.State.StartedAt),
 		}
-		if containerName == "net" && inspectResult.NetworkSettings != nil {
+		if containerName == "POD" && inspectResult.NetworkSettings != nil {


can we const name "POD"? Seems like we use it in a lot of places

vishh · 2015-01-27T00:50:10Z

Except for the few nits, LGTM!

thockin · 2015-01-27T04:49:19Z

pkg/kubelet/kubelet.go

@@ -1112,7 +1113,7 @@ func (kl *Kubelet) syncPod(pod *api.BoundPod, dockerContainers dockertools.Docke
 			}
 		}
 		// TODO(dawnchen): Check RestartPolicy.DelaySeconds before restart a container
-		containerID, err := kl.runContainer(pod, &container, podVolumes, "container:"+string(netID))
+		containerID, err := kl.runContainer(pod, &container, podVolumes, fmt.Sprintf("container:%v", podInfraContainerID), fmt.Sprintf("container:%v", podInfraContainerID))


nit: could Sprintf it once into a variable.

Sure, fixing.

thockin · 2015-01-27T04:49:35Z

LGTM! Thanks

brendandburns · 2015-01-27T05:06:02Z

pkg/kubelet/kubelet.go

@@ -878,21 +879,21 @@ func (kl *Kubelet) killContainerByID(ID, name string) error {
 }

 const (
-	networkContainerName  = "net"
-	NetworkContainerImage = "kubernetes/pause:latest"
+	podInfraContainerName  = "POD" // caps are not allowed by users, but are OK for docker.


Please don't duplicate this const declaration in multiple places...

How about just keeping the one in dockertools package?

Made that change. Let me know if you prefer to extract it out to some other package.

brendandburns · 2015-01-27T05:10:03Z

LGTM, except the one small comment about not duplicating a constant.

bgrant0607 · 2015-01-27T08:10:58Z

Does this change our minimum required Docker version, or will this field just be silently ignored on old versions?

mrunalp · 2015-01-27T17:15:02Z

@bgrant0607 I believe so, but I can test that and confirm.

mrunalp · 2015-01-27T17:43:57Z

@bgrant0607 IpcMode is ignored when used with older docker version (1.3.*)

https://gist.github.com/mrunalp/53d128f4654971033f11

go run ipctest.go                                                                                                                                     
Container started successfully
[mrunal@dhcp-16-139 go]$ sudo docker ps
CONTAINER ID        IMAGE                 COMMAND             CREATED             STATUS              PORTS               NAMES
51b043956885        kubernetes/pause:go   "/pause"            5 seconds ago       Up 4 seconds                            ipctest             
a85c1b84f30a        kubernetes/pause:go   "/pause"            4 minutes ago       Up 4 minutes                            hungry_mclean       
[mrunal@dhcp-16-139 go]$ 
[mrunal@dhcp-16-139 go]$ 
[mrunal@dhcp-16-139 go]$ 
[mrunal@dhcp-16-139 go]$ 
[mrunal@dhcp-16-139 go]$ 
[mrunal@dhcp-16-139 go]$ docker inspect 51b043956885 | grep Mode
        "NetworkMode": "container:a85c1b84f30aa99223",
[mrunal@dhcp-16-139 go]$ 
[mrunal@dhcp-16-139 go]$ docker inspect 51b043956885 | grep Pid
        "Pid": 15107,
[mrunal@dhcp-16-139 go]$ docker inspect a85c1b84f30a | grep Pid
        "Pid": 14546,
[mrunal@dhcp-16-139 go]$ sudo ls -l /proc/15107/ns
total 0
lrwxrwxrwx. 1 root root 0 Jan 27 09:40 ipc -> ipc:[4026532585]
lrwxrwxrwx. 1 root root 0 Jan 27 09:40 mnt -> mnt:[4026532583]
lrwxrwxrwx. 1 root root 0 Jan 27 09:40 net -> net:[4026532484]
lrwxrwxrwx. 1 root root 0 Jan 27 09:40 pid -> pid:[4026532586]
lrwxrwxrwx. 1 root root 0 Jan 27 09:40 user -> user:[4026531837]
lrwxrwxrwx. 1 root root 0 Jan 27 09:40 uts -> uts:[4026532584]
[mrunal@dhcp-16-139 go]$ sudo ls -l /proc/14546/ns
total 0
lrwxrwxrwx. 1 root root 0 Jan 27 09:38 ipc -> ipc:[4026532481]
lrwxrwxrwx. 1 root root 0 Jan 27 09:38 mnt -> mnt:[4026532479]
lrwxrwxrwx. 1 root root 0 Jan 27 09:38 net -> net:[4026532484]
lrwxrwxrwx. 1 root root 0 Jan 27 09:38 pid -> pid:[4026532482]
lrwxrwxrwx. 1 root root 0 Jan 27 09:38 user -> user:[4026531837]
lrwxrwxrwx. 1 root root 0 Jan 27 09:38 uts -> uts:[4026532480]

bgrant0607 · 2015-01-27T17:58:55Z

Thanks.

mrunalp · 2015-01-27T23:27:18Z

@brendanburns @thockin Does this look good now?

thockin · 2015-01-27T23:30:42Z

LGTM

bgrant0607 · 2015-01-27T23:30:56Z

LGTM from me, also. Kicking travis.

Shared IPC namespace for containers in a pod

brendandburns · 2015-01-28T05:09:43Z

This PR broke e2e because update.sh is depending on the presence of a container named "net"

I'll fix.

thockin · 2015-01-28T05:29:02Z

mea culpa - too happy to get it in.

On Tue, Jan 27, 2015 at 9:10 PM, Brendan Burns notifications@github.com
wrote:

This PR broke e2e because update.sh is depending on the presence of a
container named "net"

I'll fix.

Reply to this email directly or view it on GitHub
#3817 (comment)
.

brendandburns · 2015-01-28T05:32:46Z

np, I'm running it in e2e right now...

On Tue, Jan 27, 2015 at 9:29 PM, Tim Hockin notifications@github.com
wrote:

mea culpa - too happy to get it in.

On Tue, Jan 27, 2015 at 9:10 PM, Brendan Burns notifications@github.com
wrote:

This PR broke e2e because update.sh is depending on the presence of a
container named "net"

I'll fix.

Reply to this email directly or view it on GitHub
<
#3817 (comment)

.

—
Reply to this email directly or view it on GitHub
#3817 (comment)
.

mrunalp · 2015-01-28T06:18:41Z

Sorry about that! Thanks for fixing.

mrunalp mentioned this pull request Jan 27, 2015

Shared PID and UTS namespaces #1615

Closed

vmarmol reviewed Jan 27, 2015
View reviewed changes

vishh assigned thockin Jan 27, 2015

mrunalp force-pushed the feature/shared_ipc branch from 1f91a26 to a39b7a7 Compare January 27, 2015 01:27

thockin reviewed Jan 27, 2015
View reviewed changes

brendandburns reviewed Jan 27, 2015
View reviewed changes

IP: Shared IPC.

b6a0ff1

mrunalp force-pushed the feature/shared_ipc branch from a39b7a7 to b6a0ff1 Compare January 27, 2015 17:27

thockin added a commit that referenced this pull request Jan 27, 2015

Merge pull request #3817 from mrunalp/feature/shared_ipc

7e6f3af

Shared IPC namespace for containers in a pod

thockin merged commit 7e6f3af into kubernetes:master Jan 27, 2015

thockin mentioned this pull request Jan 28, 2015

Kubelet docker names should distinguish our helper container #3512

Closed

mrunalp mentioned this pull request Jan 28, 2015

Replace "net" by "pod infra" in docs, comments and format strings. #3904

Merged

erictune mentioned this pull request Feb 11, 2015

[Proposal] Security Contexts #3910

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Shared IPC namespace for containers in a pod #3817

Shared IPC namespace for containers in a pod #3817

mrunalp commented Jan 27, 2015

vmarmol Jan 27, 2015

vishh commented Jan 27, 2015

thockin Jan 27, 2015

mrunalp Jan 27, 2015

mrunalp Jan 27, 2015

thockin commented Jan 27, 2015

brendandburns Jan 27, 2015

mrunalp Jan 27, 2015

mrunalp Jan 27, 2015

brendandburns commented Jan 27, 2015

bgrant0607 commented Jan 27, 2015

mrunalp commented Jan 27, 2015

mrunalp commented Jan 27, 2015

bgrant0607 commented Jan 27, 2015

mrunalp commented Jan 27, 2015

thockin commented Jan 27, 2015

bgrant0607 commented Jan 27, 2015

brendandburns commented Jan 28, 2015

thockin commented Jan 28, 2015

brendandburns commented Jan 28, 2015

mrunalp commented Jan 28, 2015

Shared IPC namespace for containers in a pod #3817

Shared IPC namespace for containers in a pod #3817

Conversation

mrunalp commented Jan 27, 2015

vmarmol Jan 27, 2015

Choose a reason for hiding this comment

vishh commented Jan 27, 2015

thockin Jan 27, 2015

Choose a reason for hiding this comment

mrunalp Jan 27, 2015

Choose a reason for hiding this comment

mrunalp Jan 27, 2015

Choose a reason for hiding this comment

thockin commented Jan 27, 2015

brendandburns Jan 27, 2015

Choose a reason for hiding this comment

mrunalp Jan 27, 2015

Choose a reason for hiding this comment

mrunalp Jan 27, 2015

Choose a reason for hiding this comment

brendandburns commented Jan 27, 2015

bgrant0607 commented Jan 27, 2015

mrunalp commented Jan 27, 2015

mrunalp commented Jan 27, 2015

bgrant0607 commented Jan 27, 2015

mrunalp commented Jan 27, 2015

thockin commented Jan 27, 2015

bgrant0607 commented Jan 27, 2015

brendandburns commented Jan 28, 2015

thockin commented Jan 28, 2015

brendandburns commented Jan 28, 2015

mrunalp commented Jan 28, 2015